Discover What Apps or Processes are Interacting with a File in Mac OS X

Using the lsof command, we can find out exactly what process or application is using a specified file at that given moment. This is similar to the opensnoop command, but rather than watching the changes to a file over time, lsof can give us a snapshot of this very moment, which can be helpful for troubleshooting purposes.

lsof /path/to/filename

For an example, to see what is interacting with with /var/log/system.log we point it at that file:

In this case the app using system.log is “Console”. Again, this is showing us a snapshot at the moment the lsof command was executed, but by using the previously mentioned opensnoop command instead you can follow what processes use that file in real time:

This website and third-party tools use cookies for functional, analytical, and advertising purposes. By continuing to browse the site, closing this banner, scrolling this webpage, or clicking a link, you agree to these cookies. You can review our privacy policy for additional information.I AcceptPrivacy Policy